Cybersecurity is integral to an IT service
Important ruling by Amsterdam High Court
An influential ruling by Amsterdam High Court made the news this week. The court ruled that an IT vendor can reasonably be expected to ensure that their product is secure, even if the contract doesn't explicitly cover security. Indeed, if the client doesn't accept the vendor's security advice, the vendor should, in the last resort, refuse the commission.
IT vendor liable
The case in question involved an IT vendor that installed the office infrastructure for an accountancy firm in Hilversum. Unfortunately, the system turned out to be insecure. Cybercriminals took advantage by installing ransomware on the infrastructure. Afterwards, the accountants sought damages from the IT firm. In response, the vendor argued that it hadn't been contracted to provide security, and that the customer did not take up suggestions about how security could be arranged.
Security is integral
The court ruled that it was "untenable to argue that the commission of a comprehensive service did not include the provision of security". The ruling is important, because it effectively establishes the principle that security is integral to any such service. If the customer declined to implement security measures, the vendor should at least have taken issue with that decision. In the last resort, the vendor should have refused the commission as non-fulfillable. The court largely upheld the accountancy firm's arguments.
Buyer should be able to depend on a vendor
To a large extent, therefore, a buyer should be able to depend on an IT vendor to take care of security. Nevertheless, it would have been in the accountancy firm's interest to do more. After all, the damages awarded fall well short of what the incident and legal proceedings will have cost.
Understanding your cybersecurity status
What are the implications of this ruling? Certainly, IT vendors need to go further in terms of recognising that cybersecurity is integral to a good product or service. However, there are also lessons for buyers and service users. Not least that it's important to understand your business's cybersecurity status.
Direct control and insight are preferable
Frank van der Maaten, Chief Executive of CyberSterk partner ArchilogiQ says, "I would want to see for myself that everything was in order, rather than trust a vendor blindly. Where cybersecurity is concerned, I think it's always preferable to have direct control and insight." In line with that outlook, ArchilogiQ has been making CyberSterk available to business customers for some time now.
